Taskfile.yml

version: '3'

env:
  GOFLAGS: -mod=vendor
  GOPROXY: 'off'
  GOSUMDB: 'off'
  GOTOOLCHAIN: local
  # Match release/daemon builds. Real cgo (net/os/user) makes AllThreadsSyscall
  # return ENOTSUP. Fakecgo under CGO_ENABLED=0 panics and breaks Landlock.
  CGO_ENABLED: '0'

vars:
  GOCMD: go
  LIBS_ROOT: '{{default "../Reticulum-Go-Deps" .LIBS_ROOT}}'
  GO_LEGACY_WIN7: '{{default "/usr/local/go-legacy-win7/bin/go" .GO_LEGACY_WIN7}}'
  GO_LEGACY_WINXP: '{{default "/usr/local/go-legacy-winxp/bin/go" .GO_LEGACY_WINXP}}'
  BINARY_NAME: reticulum-go
  BUILD_DIR: bin
  MAIN_PACKAGE: ./cmd/reticulum-go
  PREFIX: '{{default "/usr/local" .PREFIX}}'
  DESTDIR: '{{default "" .DESTDIR}}'
  SCAN_GO_PACKAGES: ./pkg/... ./cmd/... ./internal/... ./tests/...
  TRIVY_SKIP_DIR_FLAGS: --skip-dirs vendor --skip-dirs .cache

includes:
  build:
    taskfile: ./taskfiles/build.yml
    flatten: true
  test:
    taskfile: ./taskfiles/test.yml
    flatten: true
  examples:
    taskfile: ./taskfiles/examples.yml
    flatten: true
  docker:
    taskfile: ./taskfiles/docker.yml
    flatten: true
  trivy:
    taskfile: ./taskfiles/trivy.yml
    flatten: true
  microvm:
    taskfile: ./taskfiles/microvm.yml
    flatten: true

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  all:
    desc: Clean, download dependencies, build and test
    deps: [clean, deps, build, test]

  fmt:
    desc: Format Go code
    cmds:
      - '{{.GOCMD}} fmt ./...'

  fmt-check:
    desc: Check if code is formatted (useful for CI)
    cmds:
      - |
        UNFORMATTED=$(gofmt -l $(git ls-files '*.go' ':!:vendor/**' ':!:**/vendor/**'))
        if [ -n "$UNFORMATTED" ]; then
          echo "Code is not formatted. Run 'task fmt' to fix."
          echo "$UNFORMATTED"
          exit 1
        fi

  vet:
    desc: Run go vet
    cmds:
      - '{{.GOCMD}} vet ./...'

  lint:
    desc: Run revive linter
    cmds:
      - revive -config revive.toml -formatter friendly -exclude './vendor/...' ./pkg/... ./cmd/... ./internal/...

  staticcheck:
    desc: Run staticcheck on core packages
    cmds:
      - staticcheck -tests=false ./pkg/... ./cmd/... ./internal/... ./tests/...

  scan:
    desc: Run gosec security scanner
    cmds:
      # Vendored code and generated test fixtures are excluded from scanning.
      - gosec -exclude-dir=vendor -exclude-dir=.cache -exclude-dir=testdata {{.SCAN_GO_PACKAGES}}

  vulncheck:
    desc: Run govulncheck (Go vulnerability database)
    cmds:
      - |
        if command -v govulncheck >/dev/null 2>&1; then
          env GOFLAGS= GOSUMDB=sum.golang.org GOPROXY=https://proxy.golang.org,direct \
            govulncheck {{.SCAN_GO_PACKAGES}}
        else
          env GOFLAGS= GOSUMDB=sum.golang.org GOPROXY=https://proxy.golang.org,direct \
            go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 {{.SCAN_GO_PACKAGES}}
        fi

  prepush:
    desc: Fast checks before push (fmt-check, vet, lint, test-short)
    deps: [fmt-check, vet, lint, test-short]

  check:
    desc: Run fmt-check, vet, lint, staticcheck, test-short, scan, vulncheck with summary
    cmds:
      - |
        FAILED_TASKS=""
        FAIL_COUNT=0
        TOTAL_TASKS=7

        echo "--- Running all checks ---"
        task fmt-check || { FAILED_TASKS="$FAILED_TASKS fmt-check"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task vet || { FAILED_TASKS="$FAILED_TASKS vet"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task lint || { FAILED_TASKS="$FAILED_TASKS lint"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task staticcheck || { FAILED_TASKS="$FAILED_TASKS staticcheck"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task test-short || { FAILED_TASKS="$FAILED_TASKS test-short"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task scan || { FAILED_TASKS="$FAILED_TASKS scan"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
        task vulncheck || { FAILED_TASKS="$FAILED_TASKS vulncheck"; FAIL_COUNT=$((FAIL_COUNT + 1)); }

        echo "------------------------------------------"
        if [ $FAIL_COUNT -eq 0 ]; then
          echo "OK: All checks passed!"
        else
          echo "ERROR: $FAIL_COUNT task(s) failed out of $TOTAL_TASKS!"
          echo "Failed tasks:$FAILED_TASKS"
          exit 1
        fi

  bench:
    desc: Run benchmarks with standard GC
    cmds:
      - '{{.GOCMD}} test -run=^$ -bench=. -benchmem ./...'

  bench-experimental:
    desc: Run benchmarks with experimental GC
    env:
      GOEXPERIMENT: greenteagc
    cmds:
      - '{{.GOCMD}} test -run=^$ -bench=. -benchmem ./...'

  bench-compare:
    desc: Run benchmarks with both GC settings
    deps: [bench, bench-experimental]

  clean:
    desc: Remove build artifacts
    cmds:
      - '{{.GOCMD}} clean'
      - rm -rf {{.BUILD_DIR}}
      - make -C bindings/odin clean
      - make -C bindings/zig clean
      - make -C bindings/dart clean

  reproducibility:
    desc: Fail if two consecutive release builds (trimpath, no VCS stamp) are not byte-identical
    cmds:
      - sh scripts/ci/reproducibility-build.sh

  tree-manifest:
    desc: Print SHA-256 inventory of git-tracked files (excludes reticulum-go.rsm and vendor/)
    cmds:
      - sh scripts/ci/tree-manifest.sh generate

  tree-rsm-sign:
    desc: Sign tree inventory into reticulum-go.rsm (requires RNS_ID_PATH)
    cmds:
      - sh scripts/ci/sign-tree-rsm.sh

  tree-rsm-verify:
    desc: Verify reticulum-go.rsm signature and byte-level file hashes
    cmds:
      - sh scripts/ci/verify-tree-rsm.sh

  hooks:install:
    desc: Enable tracked .githooks (Go, YAML, shellcheck, commit-msg, pre-push, RSM)
    cmds:
      - sh scripts/ci/install-git-hooks.sh

  gitsign:setup:
    desc: Configure gitsign commit signing (SIGSTORE_* env for private Fulcio/Rekor/OIDC)
    cmds:
      - sh scripts/ci/setup-gitsign.sh

  gittuf:init:
    desc: Initialize gittuf repository security policy (requires gittuf + signing key)
    cmds:
      - sh scripts/ci/gittuf-init.sh

  doctor:
    desc: Verify dev tools match CI pins
    cmds:
      - sh scripts/ci/doctor.sh

  bootstrap:
    desc: Install pinned Go dev tools (task, revive, staticcheck)
    cmds:
      - sh scripts/ci/bootstrap.sh

  changelog-preview:
    desc: Preview unreleased CHANGELOG section from conventional commits
    cmds:
      - sh scripts/ci/changelog-preview.sh

  tree-workspace-clean:
    desc: Recheck inventory and fail on unexpected workspace changes
    cmds:
      - sh scripts/ci/verify-workspace-clean.sh "${RNS_INVENTORY_OUT:-/tmp/reticulum-go-tree-inventory.txt}"

  vendor-sync:
    desc: Refresh vendor trees from Reticulum-Go-Deps
    cmds:
      - sh scripts/vendor-sync.sh "{{.LIBS_ROOT}}"

  deps:
    desc: Refresh vendored dependencies from Reticulum-Go-Deps (offline after sync)
    cmds:
      - task: vendor-sync

  install:
    desc: Install binary, tool symlinks, and man pages (PREFIX, DESTDIR)
    cmds:
      - make install PREFIX="{{.PREFIX}}" DESTDIR="{{.DESTDIR}}"

  run:
    desc: Run with go run
    cmds:
      - '{{.GOCMD}} run {{.MAIN_PACKAGE}}'

  ci:
    desc: Run the same static checks as the CI lint job
    deps: [fmt-check, vet, lint, staticcheck]